Professional LAMP: Linux®, Apache, MySQL®, and PHP5 Web Development

7.1. Controlling Access

When you think about securing a website, one of the first things that might come to your mind is a way to restrict access. If the bad guys can't get to the web application, it's safe, right? When you choose a way to protect your sensitive files and scripts, you have a couple of choices, some built-in to Apache, some that are PHP-based, and some that are a mixture of the two.

7.1.1. Apache-Controlled Authentication

The easiest way to lock down a website is to use Basic Authentication, which was covered in Chapter 6. Using a combination of .htaccess and password files, you can quickly restrict access to any given folder of your website. This approach has many advantages.

Primarily, it is extremely easy to implement. Coming standard with the default installation of Apache, simple per-directory Basic Authentication can easily be set up using either .htaccess or <Directory> entries.

What is the downside to using the built-in Apache authentication? It can be a hassle to maintain a complex hierarchy of restricted folders and users. If you have a large number of users or groups, and a fair number of protected directories, it can quickly become a nightmare to ensure the proper users are in the proper groups, with access to the proper resources, with current passwords, and so on.

Simple authentication with Apache can also be a problem if you're dealing with multiple load-balanced or mirrored web servers. Because the user credentials are stored on each machine, you ...